[DOCS] Add EQL limitations page (#52001)

Documents limitations for EQL in Elasticsearch.
This commit is contained in:
James Rodewig 2020-02-12 08:45:15 -05:00
parent 20453d3ac8
commit ca34817659
2 changed files with 31 additions and 0 deletions

View File

@ -32,7 +32,9 @@ Consider using EQL if you:
* <<eql-requirements>> * <<eql-requirements>>
* <<eql-search>> * <<eql-search>>
* <<eql-syntax>> * <<eql-syntax>>
* <<eql-limitations>>
include::requirements.asciidoc[] include::requirements.asciidoc[]
include::search.asciidoc[] include::search.asciidoc[]
include::syntax.asciidoc[] include::syntax.asciidoc[]
include::limitations.asciidoc[]

View File

@ -0,0 +1,29 @@
[role="xpack"]
[testenv="basic"]
[[eql-limitations]]
== EQL limitations
++++
<titleabbrev>Limitations</titleabbrev>
++++
experimental::[]
[discrete]
[[eql-unsupported-syntax]]
=== Unsupported syntax
{es} supports a subset of {eql-ref}/index.html[EQL syntax]. {es} cannot run EQL
queries that contain:
* {eql-ref}/functions.html[Functions]
* {eql-ref}/joins.html[Joins]
* {eql-ref}/basic-syntax.html#event-relationships[Lineage-related keywords]:
** `child of`
** `descendant of`
** `event of`
* {eql-ref}/pipes.html[Pipes]
* {eql-ref}/sequences.html[Sequences]